______________________________________________________________________________

                        SuSE Security Announcement

        Package:  sccw-1.x
        Date:     Mon Sep 27 23:06:13 CEST 1999
        Affected: all Linux distributions using sccw 1.x
______________________________________________________________________________

A security hole was discovered in the package mentioned above.
Please update as soon as possible or disable the service if you are using
this software on your SuSE Linux installation(s).

Other Linux distributions or operating systems might be affected as
well, please contact your vendor for information about this issue.

Please note, that that we provide this information on "as-is" basis only.
There is no warranty whatsoever and no liability for any direct, indirect or
incidental damage arising from this information or the installation of
the update package.
_____________________________________________________________________________

1. Problem Description

  sccw does insufficient bounds checking, trust it's environment and
  calls insecure system functions.
  On a default installation sccw is setuid root.

2. Impact

  These bugs lead to local root compromise.

3. Solution

  Updated the sccw package from our FTP server.
______________________________________________________________________________

Here are the md5 checksums of the upgrade packages, please verify these
before installing the new packages:

  3b2fc3d5025f1298e460ad26735af601  sccw-1.1-39.i386.rpm
  373435f60b236c8d52ee535021471e4c  sccw-1.1-39.src.rpm
______________________________________________________________________________

You will find the update on our ftp-Server:
    
Webpage for patches:
  http://www.suse.de/patches/index.html

or try the following web pages for a list of mirrors:
  http://www.suse.de/ftp.html
  
______________________________________________________________________________